External Disk went RAW
Posted: 28 Jul 2017, 09:44
Hi folks,
My Problem with a Seagate Backup Plus STCA3000200 3TB (bought in Feb/2013):
I moved complete content of disk in a folder X (in the same disk) and created beside folder X a new folder Y for upcoming backups. Folder Y got filled with files from another disk.
After that i disconnected the USB and drive was 2-5day off. (turns power off automaticaly by disconnecting USB)
Few days later connected Drive again and after 2-3mins got the message "Drive has to be formated". Since then the filesystem is "RAW".
It takes every time 2-5mins to get the message and only after that message TestDisk or any other software is able to work with drive.
After 2days of reading and trying with TestDisk, TestDisk was not able to List any files or the right partition type. Now, few day later again, it detects again.
A deepsearch feels like that it would take years.
Drive is not making any odd noises.
My efforts with TestDisk:
TestDisk lists both folder, X and Y.
Folder Y is already rescued.
In folder X, which is my intrest, is only listing one folder, from the 20-30 folders it should have.
One strange thing:
Testdisk is sporadically detecting a "Intel"- or "EFI GPT"-Partition. In both cases i can list folder X and Y.
Had already a try with PhotoRec and sadly its not findig the files which I`m searching for.
Any suggestions?
One idea, which i got yesterday:
What if I (quick-)format the drive and then try to recover "deleted" files?
Regards
jimmy
Last .log-File:
My Problem with a Seagate Backup Plus STCA3000200 3TB (bought in Feb/2013):
I moved complete content of disk in a folder X (in the same disk) and created beside folder X a new folder Y for upcoming backups. Folder Y got filled with files from another disk.
After that i disconnected the USB and drive was 2-5day off. (turns power off automaticaly by disconnecting USB)
Few days later connected Drive again and after 2-3mins got the message "Drive has to be formated". Since then the filesystem is "RAW".
It takes every time 2-5mins to get the message and only after that message TestDisk or any other software is able to work with drive.
After 2days of reading and trying with TestDisk, TestDisk was not able to List any files or the right partition type. Now, few day later again, it detects again.
A deepsearch feels like that it would take years.
Drive is not making any odd noises.
My efforts with TestDisk:
TestDisk lists both folder, X and Y.
Folder Y is already rescued.
In folder X, which is my intrest, is only listing one folder, from the 20-30 folders it should have.
One strange thing:
Testdisk is sporadically detecting a "Intel"- or "EFI GPT"-Partition. In both cases i can list folder X and Y.
Had already a try with PhotoRec and sadly its not findig the files which I`m searching for.
Any suggestions?
One idea, which i got yesterday:
What if I (quick-)format the drive and then try to recover "deleted" files?
Regards
jimmy
Last .log-File:
Code: Select all
Thu Jul 27 15:11:10 2017
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=999095795712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592977920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=998501253120
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=479509610496
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000579915776
Hard disk list
Disk \\.\PhysicalDrive0 - 999 GB / 930 GiB - CHS 121466 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096
Drive C: - 998 GB / 929 GiB - CHS 121394 255 63, sector size=512
Drive D: - 479 GB / 446 GiB - CHS 58297 255 63, sector size=512
Drive E: - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096
Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB - CHS 45600 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 45600 23 55 732563456 [Seagate Backup Plus Drive]
pread: Input/output error
Failed to calculate number of free clusters: Input/output error.
Failed to read index block: Input/output error.
search_part()
Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB - CHS 45600 255 63
file_win32_pread(224,3,buffer,21(0/0/22)) read err: read after end of file
file_win32_pread(224,2,buffer,21(0/0/22)) read err: read after end of file
file_win32_pread(224,1,buffer,262(0/4/11)) read err: read after end of file
file_win32_pread(224,2,buffer,32(0/0/33)) read err: read after end of file
NTFS at 0/32/33
filesystem size 732563456
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 366281727
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 32 33 45600 23 55 732563456 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
Results
* HPFS - NTFS 0 32 33 45600 23 55 732563456 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_win32_pread(224,2,buffer,366303770(22801/90/36)) read err: read after end of file
file_win32_pread(224,1,buffer,366303770(22801/90/36)) read err: read after end of file
NTFS filesystem need to be repaired.
dir_partition inode=5
* HPFS - NTFS 0 32 33 45600 23 55 732563456 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
Directory /
5 dr-xr-xr-x 0 0 0 3-Jun-2017 16:12 .
5 dr-xr-xr-x 0 0 0 3-Jun-2017 16:12 ..
111 dr-xr-xr-x 0 0 0 31-Jan-2017 18:14 $RECYCLE.BIN
837042 dr-xr-xr-x 0 0 0 3-Jun-2017 16:12 FOLDER Y
595293 dr-xr-xr-x 0 0 0 27-Jan-2014 20:36 RECYCLER
27 dr-xr-xr-x 0 0 0 25-Apr-2015 12:54 System Volume Information
837039 dr-xr-xr-x 0 0 0 1-Jun-2017 18:00 FOLDER X
22128 dr-xr-xr-x 0 0 0 5-Dec-2014 12:18 found.000
111 -r--r--r-- 0 0 20 31-Jan-2017 18:14 $RECYCLE.BIN:Mac_Metadata
5 -r--r--r-- 0 0 8 3-Jun-2017 16:12 ..:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
5 -r--r--r-- 0 0 4 3-Jun-2017 16:12 ..:MTIME
5 -r--r--r-- 0 0 8 3-Jun-2017 16:12 .:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
5 -r--r--r-- 0 0 4 3-Jun-2017 16:12 .:MTIME
595293 -r--r--r-- 0 0 20 27-Jan-2014 20:36 RECYCLER:Mac_Metadata
27 -r--r--r-- 0 0 20 25-Apr-2015 12:54 System Volume Information:Mac_Metadata
22128 -r--r--r-- 0 0 20 5-Dec-2014 12:18 found.000:Mac_Metadata
dir_partition inode=837039
* HPFS - NTFS 0 32 33 45600 23 55 732563456 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_win32_pread(224,2,buffer,216327007(13465/187/2)) read err: read after end of file
file_win32_pread(224,1,buffer,216327007(13465/187/2)) read err: read after end of file
ntfs_readdir failed for cluster 837039: Input/output error
Directory /FOLDER X
837039 dr-xr-xr-x 0 0 0 1-Jun-2017 18:00 .
5 dr-xr-xr-x 0 0 0 3-Jun-2017 16:12 ..
347000 dr-xr-xr-x 0 0 0 23-Jan-2014 20:16 Samsung NP-N150Plus Treiber usw
5 -r--r--r-- 0 0 8 3-Jun-2017 16:12 ..:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
5 -r--r--r-- 0 0 4 3-Jun-2017 16:12 ..:MTIME
660938 -r--r--r-- 0 0 17734 7-Nov-2007 07:00 eula.1042.txt
660835 -r--r--r-- 0 0 95248 7-Nov-2007 07:03 install.res.1040.dll
Directory /
5 dr-xr-xr-x 0 0 0 3-Jun-2017 16:12 .
5 dr-xr-xr-x 0 0 0 3-Jun-2017 16:12 ..
111 dr-xr-xr-x 0 0 0 31-Jan-2017 18:14 $RECYCLE.BIN
837042 dr-xr-xr-x 0 0 0 3-Jun-2017 16:12 FOLDER Y
595293 dr-xr-xr-x 0 0 0 27-Jan-2014 20:36 RECYCLER
27 dr-xr-xr-x 0 0 0 25-Apr-2015 12:54 System Volume Information
837039 dr-xr-xr-x 0 0 0 1-Jun-2017 18:00 FOLDER X
22128 dr-xr-xr-x 0 0 0 5-Dec-2014 12:18 found.000
111 -r--r--r-- 0 0 20 31-Jan-2017 18:14 $RECYCLE.BIN:Mac_Metadata
5 -r--r--r-- 0 0 8 3-Jun-2017 16:12 ..:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
5 -r--r--r-- 0 0 4 3-Jun-2017 16:12 ..:MTIME
5 -r--r--r-- 0 0 8 3-Jun-2017 16:12 .:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
5 -r--r--r-- 0 0 4 3-Jun-2017 16:12 .:MTIME
595293 -r--r--r-- 0 0 20 27-Jan-2014 20:36 RECYCLER:Mac_Metadata
27 -r--r--r-- 0 0 20 25-Apr-2015 12:54 System Volume Information:Mac_Metadata
22128 -r--r--r-- 0 0 20 5-Dec-2014 12:18 found.000:Mac_Metadata